National Instruments LabVIEW 2015 < 2015 SP1 f7 / 2016 < 2016 f2 LvVarientUnflatten VI File Handling Arbitrary Code Execution

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(99928);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12");

  script_cve_id("CVE-2017-2775");
  script_bugtraq_id(97020);

  script_name(english:"National Instruments LabVIEW 2015 < 2015 SP1 f7 / 2016 < 2016 f2 LvVarientUnflatten VI File Handling Arbitrary Code Execution");
  script_summary(english:"Checks the version of National Instruments LabVIEW.");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by
an arbitrary code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of National Instruments (NI) LabVIEW installed on the
remote Windows host is version 2015 prior to 2015 SP1 f7 or 2016 prior
to 2016 f2. It is, therefore, affected by an arbitrary code execution
vulnerability in the LvVarientUnflatten functionality due to improper
validation of user-supplied input. An unauthenticated, remote attacker
can exploit this, by convincing a user to open a specially crafted VI
file, to cause a heap-based buffer overflow, allowing the execution of
arbitrary code.");
  script_set_attribute(attribute:"see_also", value:"http://www.ni.com/product-documentation/53294/en/");
  script_set_attribute(attribute:"see_also", value:"http://www.ni.com/product-documentation/53281/en/");
  script_set_attribute(attribute:"see_also", value:"http://www.ni.com/labview/product-lifecycle/");
  script_set_attribute(attribute:"see_also", value:"http://www.talosintelligence.com/reports/TALOS-2017-0269/");
  # http://blog.talosintelligence.com/2017/03/vulnerability-spotlight-code-execution.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d98a385a");
  script_set_attribute(attribute:"solution", value:
"Upgrade to NI LabVIEW version 2015 SP1 f7 (2015.1.7) / 2016 f2
(2016.0.2) or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-2775");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"in_the_news", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/03/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/03/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/05/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ni:labview");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("labview_installed.nbin");
  script_require_keys("installed_sw/National Instruments LabVIEW", "SMB/Registry/Enumerated");

  exit(0);
}

include('audit.inc');
include('global_settings.inc');
include('install_func.inc');
include('misc_func.inc');
include('smb_func.inc');

get_kb_item_or_exit("SMB/Registry/Enumerated");
arch = get_kb_item_or_exit('SMB/ARCH', exit_code:1);

if (arch == "x86")
  audit(AUDIT_ARCH_NOT, "x64");

app_name = "National Instruments LabVIEW";
install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE);

app_arch = install['architecture'];
if (app_arch == 'x86')
{
  audit(AUDIT_INST_VER_NOT_VULN, app_name, app_arch);
}

# application software
version = install['version'];
display_version = install['display_version'];

# run-time engine
rt_ver = install['runtime_version'];
rt_display_ver = install['runtime_display_version'];

path = install['path'];

fix = NULL;
fix_display = NULL;
vuln = FALSE;

if (version =~ "^2015")
{
  # Run-time engine patch
  fix = "2015.1.7";
  fix_display = "2015 SP1 f7";
  version = rt_ver;
  display_version = rt_display_ver;
}
else if (version =~ "^2016")
{
  # Application software patch
  fix = "2016.0.2";
  fix_display = "2016 f2";
}
else
{
  # any version prior to 2015
  if (version =~ "^20(09|1[0-4])|^[78]\.")
  {
    vuln = TRUE;
    fix_display = "2015 SP1 f7";
  }
  else # 2017+
    audit(AUDIT_INST_PATH_NOT_VULN, app_name, display_version, path);
}

if ( vuln || (ver_compare(ver:version, fix:fix, strict:FALSE) < 0) )
{
  port = kb_smb_transport();
  items = make_array(
    "Path", path,
    "Installed version", display_version,
    "Fixed version", fix_display
  );

  order = make_list("Path", "Installed version", "Fixed version");
  report = report_items_str(report_items:items, ordered_fields:order);
  security_report_v4(port:port, extra:report, severity:SECURITY_WARNING);
}
else
  audit(AUDIT_INST_PATH_NOT_VULN, app_name, display_version, path);